Merge pull request #1152 from rackerlabs/argo-workflows-update

chore: refactor argo workflows and argo events installation

Author: cardoe

components/argo-events/argo-role.yaml

@@ -0,0 +1,8 @@
+apiVersion: apps/v1
+kind: RoleBinding
+metadata:
+  name: argo-server-binding
+subjects:
+- kind: ServiceAccount
+  name: argo-server
+  namespace: argo

components/argo-events/argo-server-rb.yaml

@@ -0,0 +1,8 @@
+apiVersion: apps/v1
+kind: RoleBinding
+metadata:
+  name: argo-binding
+subjects:
+- kind: ServiceAccount
+  name: argo
+  namespace: argo

components/argo-events/argo-server-role.yaml

@@ -7,19 +7,26 @@ resources:
   - https://github.com/argoproj/argo-events/releases/download/v1.9.7/install.yaml
   - https://github.com/argoproj/argo-events/releases/download/v1.9.7/install-validating-webhook.yaml
 
-  ## configure rbac to integrate with argo-workflow
-  # - default-role.yaml
-  - argo-server-role.yaml
-  - argo-role.yaml
+  # grant the argo-workflows the ability to run workflows in this namespace
+  - https://github.com/argoproj/argo-workflows/manifests/namespace-install/argo-server-rbac?ref=v3.5.10
+  - https://github.com/argoproj/argo-workflows/manifests/namespace-install/workflow-controller-rbac?ref=v3.5.10
 
   ## configure webhook Sensor and associated role
   - sensor-workflow-role.yaml
   - workflow-role.yaml
 
   - configmaps.yaml
 
-  ## allow neutron's service account to submit workflows
-  - svc-neutron.yaml
-
   ## copy openstack/cinder-netapp-config to argo-events/netapp-config
   - secret-netapp.yaml
+
+patches:
+- target:
+    kind: RoleBinding
+    name: argo-binding
+  path: controller-rb.yaml
+
+- target:
+    kind: RoleBinding
+    name: argo-server-binding
+  path: argo-server-rb.yaml

components/argo-events/controller-rb.yaml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argo-server
+spec:
+  template:
+    spec:
+      containers:
+      - name: argo-server
+        args:
+        - server
+        # allow SSO, which currently has all clients use the server's ServiceAccount
+        - --auth-mode=sso
+        # all other auth via Kubernetes bearer tokens
+        - --auth-mode=client
+        # running in namespaced mode and not cluster wide
+        - --namespaced
+        # configures the namespace where workflows actually run
+        - --managed-namespace
+        - argo-events